Conversations on Strategy Podcast Conversations on Strategy Podcast – Ep 9 – Dr. Carol Evans – Enabling NATO’s Collective Defense CISR (NATO COE-DAT Handbook 1)
In 2014 NATO’s Centre of Excellence-Defence Against Terrorism (COE-DAT) launched the inaugural course on “Critical Infrastructure Protection Against Terrorist Attacks.” As this course garnered increased attendance and interest, the core lecturer team felt the need to update the course in critical infrastructure (CI) taking into account the shift from an emphasis on “protection” of CI assets to “security and resiliency.” What was lacking in the fields of academe, emergency management, and the industry practitioner community was a handbook that leveraged the collective subject matter expertise of the core lecturer team, a handbook that could serve to educate government leaders, state and private-sector owners and operators of critical infrastructure, academicians, and policymakers in NATO and partner countries. Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency is the culmination of such an effort, the first major collaborative research project under a Memorandum of Understanding between the US Army War College Strategic Studies Institute (SSI), and NATO COE-DAT.
The research project began in October 2020 with a series of four workshops hosted by SSI. The draft chapters for the book were completed in late January 2022. Little did the research team envision the Russian invasion of Ukraine in February this year. The Russian occupation of the Zaporizhzhya nuclear power plant, successive missile attacks against Ukraine’s electric generation and distribution facilities, rail transport, and cyberattacks against almost every sector of the country’s critical infrastructure have been on world display. Russian use of its gas supplies as a means of economic warfare against Europe—designed to undermine NATO unity and support for Ukraine—is another timely example of why adversaries, nation-states, and terrorists alike target critical infrastructure. Hence, the need for public-private sector partnerships to secure that infrastructure and build the resiliency to sustain it when attacked. Ukraine also highlights the need for NATO allies to understand where vulnerabilities exist in host nation infrastructure that will undermine collective defense and give more urgency to redressing and mitigating those fissures.
Click here to watch the webinar.
Keywords: critical infrastructure, cyber threats, crisis management, weaponizing critical infrastructure, security risk assessment
Episode Transcript: Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resiliency (NATO COE-DAT Handbook 1)
Stephanie Crider (Host)
You’re listening to Decisive Point, a US Army War College Press production focused on national security affairs.
The views and opinions expressed in this podcast are those of the authors and are not necessarily those of the Department of the Army, the US Army War College, or any other agency of the US government.
Decisive Point welcomes Dr. Carol V. Evans, editor of Enabling NATO’s Collective Defense: Infrastructure Security and Resiliency, which was published by the US Army War College Press in November 2022.
Evans is the director of the Strategic Studies Institute and the US Army War College Press. She brings 30 years of expertise in the areas of mission assurance, crisis and consequence management, asymmetric warfare, terrorism, maritime security, and homeland security. Since 2014, Evans has been a lecturer at the NATO Center of Excellence for the Defense Against Terrorism in Ankara, Turkey, where she teaches its Critical Infrastructure Protection Against Terrorist Attacks training program. She holds a Master of Science degree and a Doctor of Philosophy degree from the London School of Economics.
Thanks so much for joining me. I’m really excited to talk with you today.
You recently edited a book for NATO, Enabling NATO’s Collective Defense: Critical Infrastructure Security and Resilience. Why this book? Why now?
Dr. Carol Evans
Well, let me take a step back and that is explain to our audience why NATO? The SSI (Strategic Studies Institute) has had and enjoyed a very strong relationship with the NATO Center of Excellence (for the) Defense Against Terrorism in Ankara, Turkey. This book is the result of a joint research project between the two organizations. COE-DAT (it’s acronym) really focused on looking at critical infrastructure because terrorist attacks against that infrastructure have been increasing in time. And so, when we think about critical infrastructure and why now, we also need to examine the fact that infrastructure is being increasingly targeted; you just need to take a look at the news, for example, of the Russian attacks against the Ukraine infrastructure. Or if you look at, within Europe, strategic penetration by the PRC and some of their economic investments in telecommunications, in real estate, and even in the port infrastructure. All of this portends of two things. One, using critical infrastructure as a weapon of war, weaponizing that infrastructure. And so, we really need to understand critical infrastructure and the future of warfare. It’s going to be a tool for our adversaries. So, the timing was perfect for us in this book. It took about a year and a half in the making, but it is really so current and so relevant, given what we’re seeing happening right now on the battlefield.
Host
What can readers expect from this work? Can you give us an overview, please?
Evans
Sure, it’s a lengthy book, it’s I think, coming in at around 400 pages. First of all, I brought together a team of incredible international experts in critical infrastructure. Some of the authors come from high levels of government. Some of them are industry practitioners. Some of them come from academe. And some are from, you know, some of the most important government labs and other actual NATO centers of excellence. So, with this huge intellectual capability, we broke the book into four sections.
The first one looks at the evolution of threats to critical infrastructure, and we start with the basic question “What is critical infrastructure?” Luckily, both European and US definitions are in agreement, but we need to understand why infrastructure is so important and why it is being targeted and how has that threat to infrastructure evolved over time.
So that first section looks at (the) beginning with the kinetic threats to infrastructure. This is very much apropos of, sort of, terrorist means to target infrastructure, as we’ve also seen with Russia. I’m not saying they’re the same. I’m just simply saying we have states using kinetic attacks against infrastructure as well as terrorists. And then it has morphed; I guess about 10 years ago we saw increasing cyberattacks against that infrastructure, globally, and then hybrid warfare (where you have a mixture of both cyber and kinetic). So that’s sort of the first section.
Host
What does the second section cover?
Evans
Looking at what we call the lifeline sector. So, we wanted to provide case studies from each of the lifeline sectors, namely the energy sector, transportation sectors—so we have a chapter both on threats to civil aviation that has been often targeted, as you know, (not just airplanes but also airports). And also mass rail transit. You can harken back to Spain or the attacks against London and the underground.
Following transportation, we also look at telecommunications, and this is really important, as well as water. A lot of people don’t think about the water infrastructure, but it’s really really vital for many other infrastructures. And that’s why we call them lifeline(s)—because they’re so key to the quality of our life. And if you think about, particularly, energy—all of the other infrastructures rely on energy, so there is massive interdependencies between these infrastructures.
So each of the authors in those chapters really give some good case studies of both cyber and kinetic threats to that infrastructure and also discuss some of the measures, maybe to try and build that resiliency in our book, as you referenced, Critical Infrastructure Security and Resiliency. So both, how do we protect that infrastructure? But we know it’s going to go down at a certain point. Therefore, how do we build the resiliency back?
Host
What does the latter part of the book bring to the conversation?
Evans
It’s the tools and measures to build security and resiliency. What’s nice about this book is it’s not a US perspective. It is not a European perspective. We have authors from around the globe. And so they’re bringing their different backgrounds and subject matter expertise to help owners and operators or governments that have an infrastructure responsibility to think about what those tools might be. So, we first start with looking at both US and European frameworks—critical infrastructure, security resiliency frameworks—and what are then, sort of, the key policies. What are some of our key organizations? For example, here in the United States, it’s the Department of Homeland Security (and) CISA is the key organization. And then what are some other types of best practices that we can use, such as information and intelligence sharing? So, policies, practices, organizations, and how those frameworks have really helped incentivize both the government and private sector to work together to build security and resiliency.
Some other tools are modeling and analysis of critical infrastructure interdependencies. As I mentioned before, you know, energy, water—all of those sectors are very interrelated and interdependent. And so we need to understand if you’re going to lose, say, one part of your grid, what are the cascading impacts? You need to have a good sense of that situational awareness because dollars are scarce. So where can, if you’re an owner of infrastructure, or if you’re a government that needs to incentivize private owners, where are you going to put those dollars?
So you have to understand where the risks are greatest to that infrastructure failing. And that, the whole subject of risk, is another category that we look at in terms of the tools. How do you conduct security risk assessment(s)? How do you develop a risk management approach? And that particular chapter provides people, government, and industry with some of those best practices to develop their own risk programs.
And then, finally, of course, you have to talk about infrastructure and protecting it from cyber risk. So, cybersecurity is a big chapter, and that chapter focuses on the need for really good cybersecurity hygiene when it comes to industrial control systems, also known as SCADA systems. Here, the author does a really great job of explaining why SCADA is subject to such vulnerabilities. Often companies or infrastructure are using their business enterprise networks and are connecting those to their operational side where the SCADA exists. So that opens up vulnerabilities for penetration and attack. So threats, you know, lifeline sectors and then the tools to build security and resilience is really what the book is all about.
Host
You touched on this a little bit earlier. In addition to editing this work, you contributed a chapter as well: “Hybrid Threats to US and NATO Critical Infrastructure.” I’d love to hear more about it.
Evans
My chapter really focused the reader on why should NATO, or why should the Department of Defense, care about infrastructure. And so my chapter really goes pretty much in-depth, looking at three potential hybrid threat vectors to critical infrastructure. And the first area that I look at in my chapter is . . . I examine how Russian penetration, as well as some of our other adversaries, have been very active in our electric grid. And as a consequence, that infrastructure can be compromised. And this is especially important when we think about particularly from US installations and bases. We are reliant on the private sector to provide our power. That was not always the case. You know, back in the 50s, a lot of our bases had our own water supply systems, our own power-generation capacity. But over time, we have privatized most of those services, and so hence, we’re now reliant on the private sector to provide those goods and services. But how well is their cyber security?
So as I mentioned, the Federal Bureau of Investigation has cited Russia inside our grids. If we were to think about, for example, suddenly needing to deploy to support NATO, (if) we needed force projection into the European theater. If our bases go down, that’s going to interfere with our troop movement. Or if we’re along our rail systems. Or if we’re in ports where we know that those can be compromised, how will we successfully sustain a force-projection movement of some particular size and scope? So, I show how that’s a key vulnerability for us.
The second area that I look at is how our adversaries are targeting the logistical infrastructure within NATO itself. We’ve seen in Russia how logistics have played such a crucial role in their inability to successfully invade Ukraine. We’re sort of on the back foot as well, equally, because of the penetration of some of the key infrastructure sectors within Europe. Our ability to sustain ourselves, and to mobilize within the theater can be very much compromised. So I go into quite a bit of detail there.
And then the final area that I look at is the strategic investment by the People’s Republic of China into the European Defense industrial base. Chinese companies are now owning big swaths of many of the ports in Europe. There’s a lot of Chinese investment and ownership, particularly in the southern part of Europe, in their electric grids. But also, when we think about supply chain resiliency, the Chinese company Huawei has been very active in terms of trying to sell telecommunications within Europe. All of this portends, then, to when we need to fight a war with NATO in Europe, is that infrastructure going to be there when it’s largely owned and controlled by foreign adversaries? So I think this is a really important wake-up call, particularly for a number of countries that haven’t been as attentive to the strategic penetration by the Chinese in their own infrastructure.
I then conclude my chapter by looking at some of the measures NATO has been doing to address some of these issues—building capacities such as NATO Center of Excellence Defense against terrorism and leading the charge there. But building other centers of excellence, for example. More recently, again, in Turkey, we have the establishment of the MARSEC (maritime security), and they, too, are looking at the protection of maritime infrastructure. So, a lot of organizational capacity, ongoing, as well as the European Union, taking a harder look and passing not so much regulation but guidance to their member countries to review purchases of their infrastructure much more carefully and with great consideration.
Host
You have an upcoming launch event for this book. How can readers participate or even watch it after the launch?
Evans
We’ve organized some of our key authors to provide short overviews of their chapters. We will be taking questions. I’ll be actually serving as the moderator, so we hope to have a very good discussion. Mr. Ron Pierce has written a lot on the policy frameworks. Mr. Chris Anderson is going to talk about his communications chapter. Theresa Sabonis-Helf is an expert in energy, and she’s going to be talking about the Ukraine case. And Steve Bieber is an expert on waters. So, it’s going to be a dynamic and engaging panel. And I would look forward to everyone being able to download and watch it.
Host
I’d like to interject listeners. You can find the webinar at ssi.armywarcollege.edu. There’s also a link to it in the show notes.
There’s a lot to unpack in this book. Thanks so much for sharing it with us.
Evans
I appreciate the opportunity.
Host
If you’d like to learn more about NATO’s infrastructure security and resilience, download the monograph at press.armywarcollege.edu/monographs. If you enjoyed this episode and would like to hear more, you can find us on any major podcast platform.
Carol V. Evans is director of the Strategic Studies Institute and US Army War College Press at the US Army War College in Carlisle, Pennsylvania. The Strategic Studies Institute is the US Army’s leading think tank for geostrategic and national security research and analysis. She brings 30 years of expertise in the areas of mission assurance, crisis and consequence management, asymmetric warfare, terrorism, maritime security, and homeland security. Since 2014, Evans has been a lecturer at NATO’s Centre of Excellence for the Defence Against Terrorism (COE-DAT) in Ankara, Turkey, where she teaches in COE-DAT’s Critical Infrastructure Protection Against Terrorist Attacks training program. She holds a master of science degree and a doctor of philosophy degree from the London School of Economics.